Concerning the Data Protection Act 2018, the ‘controller’ of the personal data which you provide is the West Yorkshire Combined Authority (“The Combined Authority”, “we”, “us”) of Wellington House, 40-50 Wellington St, Leeds LS1 2DE (tel: 0113 251 7272). The Combined Authority has registered with the Information Commissioner’s Office with registration number ZA051694. The Combined Authority is the responsible statutory body for the WY Metro brand.
The ‘processor’ of the personal data which you provide is Yorcard Ltd, whose registered office is 11, Broad Street West, Sheffield, S1 2BQ.
Yorcard is collecting this data and will process it and share it with the Combined Authority for the following purposes:
- to deliver the MCard and Concessionary Travel Schemes,
- statistical monitoring,
- compliance with government-mandated obligations such as the National Fraud Initiative.
We would also like to keep you informed of updates and offers relating to the above schemes. We will only send you this information if you consent to receive it.
The following organisations will also process the data:
- Yorcard Limited (the app developers)
- West Yorkshire Ticketing Company (owner of the MCard brand)
- SagePay (to process payments)
The Combined Authority will not share your personal information with any other organisation or third party other than those named above. There may be other circumstances in which we may share or use certain information about you, which are:
- if we have a legal obligation to do so or if we are required or requested to do so by a competent authority such as the police or a court;
- if we need to use or disclose your information to obtain legal advice or in connection with legal proceedings;
- if we need to share your information to protect your vital interests if you are unable to give us consent or it is unreasonable for us to ask for your consent in the circumstances (e.g. if you are injured).
if we need to share your information to protect your vital interests if you are unable to give us consent or it is unreasonable for us to ask for your consent in the circumstances (e.g. if you are injured).
We will remove any customer accounts which have had no transactions for 12 months; we will also delete or anonymise any associated records.
Information provided to the Combined Authority will be processed on the basis of the performance of a contract with individuals, to deliver goods and services requested, as per Article 6(1)(b) of the GDPR. We do not require separate consent to use such data for this purpose. However, as a data subject, you have many rights under the Data Protection Act. These include the right to access the information which we hold about you. In some cases, you may have a right to have your personal data rectified, erased or restricted, and to object to specific uses of your data. You have an absolute right to demand that you stop receiving marketing information.
You may also ask us to delete your information at any time by contacting us at the address provided. This request would not affect the legality of what we do with your personal data before you withdraw consent and would not stop us from continuing to use your data to the extent that we do not require your consent. The request would prevent us from further using data for purposes which require your consent (e.g. marketing).
If you are unsatisfied with the way we collect or handle your personal data, you have a right to make a complaint to the Information Commissioner’s Office. ICO’s website (https://ico.org.uk) has information about how to make complaints.
For further information, or to contact us to make a request, please visit https://www.westyorks-ca.gov.uk/contact/
You can contact The Combined Authority’s Data Protection Officer at Rebecca.BrookesDPO@westyorks-ca.gov.uk